WooCommerce Multiple Customer Addresses & Shipping <= 21.6 - Missing Authorization leading to Authenticated (Subscriber+) Arbitrary Address Creation/Deletion/View/Updates
mediumThe WooCommerce Multiple Customer Addresses & Shipping plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 21.6. This is due to missing protections on the plugin's administrative functions. This makes it possible for subscriber-level attackers to create, delete, view, and updat...
- CVSS:
- 6.3
- Affected:
- up to 21.7
- Fixed in:
- 21.7
- Disclosed:
- Feb 27, 2023